Re: Suspicious files in /tmp

["Jamie Riden" <jamie.riden () gmail com>]

On 16/06/07, kladizkov.thehome <kladizkov.thehome () gmail com> wrote:
> Hi,
>
> My firewall LFD, pulled out three perl scripts from /tmp. It was found
> to be executing in my server. I have attached the scripts along with
> this mail. Is this issue familiar to anyone?

Sorry, a bit more. See also this thread, where Daniel Cid noticed
something similar:
http://www.securityfocus.com/archive/75/433959/30/240/threaded

> How can a script uploaded to /tmp be executed when it has noexec privilege?

The initial shell was probably run with 'perl foo.pl', so execute
permission wouldn't matter.

jamie@pokey:~/test$ chmod a-x foo.pl
jamie@pokey:~/test$ ls -l foo.pl
-rw-r--r-- 1 jamie jamie 28 2007-06-18 18:11 foo.pl
jamie@pokey:~/test$ perl foo.pl
foo!

cheers,
Jamie
--
Jamie Riden, CISSP / jamesr () europe com / jamie () honeynet org uk
UK Honeynet Project: http://www.ukhoneynet.org/

-------------------------------------------------------------------------
This list sponsored by: SPI Dynamics

ALERT: .How a Hacker Launches a SQL Injection Attack!.- White Paper 
It's as simple as placing additional SQL commands into a Web Form input box 
giving hackers complete access to all your backend systems! Firewalls and IDS 
will not stop such attacks because SQL Injections are NOT seen as intruders. 
Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! 

https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000Cn8E
--------------------------------------------------------------------------